Method for testing a control program of a control device in a simulation environment on a computer

ABSTRACT

A method for monitoring errors when testing a control program of a control device in a simulation environment, the control program being executed by an emulator on a computer, the emulator assigning an extended range of items to program variables of the control program, a variable value allocated to a program variable being stored in the extended range of items, the emulator marking program variables as erroneous or non-erroneous, the marking being carried out on the basis of an assignment of non-erroneous program variables to a first category and of erroneous program variables to a second category, or the marking being carried out on the basis of an error field stored in the extended range of items, a validity value being allocated to the error field of a non-erroneous program variable and an error value being allocated to the error field, of an erroneous program variable.

CROSS REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of German patent application no.102016105844.0, filed on Mar. 31, 2016. The entire contents are herebyincorporated by reference in its entirety.

BACKGROUND OF THE INVENTION

The invention relates to a method for testing a control program of acontrol device in a simulation environment on a computer.

J. Mauss “Chip simulation used to run automotive software on PC”,Proceedings on Embedded Real Time Software and Systems (ERTS) 2014,discloses a tool for testing control device software on a PC, thecontrol device software being executed on an emulated processor andenvironmental data being simulated. In order to test only parts of thecontrol device software, the user can specify a selection of thefunctions to be executed in a specification file. In order to determineerrors in the specification file, the control device software can begradually executed by means of a debugger.

BRIEF SUMMARY OF THE INVENTION

One object of the invention is to provide a method for testing a controlprogram of a control device in a simulation environment on a computerhaving the features of the present disclosure.

In accordance with the subject matter of the invention, the presentdisclosure provides a method for testing a control program of a controldevice in a simulation environment on a computer. The simulationenvironment is created on the computer. The control program is executedon an emulator, the emulator emulating at least one part of the controldevice having a processor and a memory area. The emulator is executed onthe computer and has an interface for inputting and outputting data,environmental values from the simulation environment are written to theemulated memory area via the interface. The control program has programvariables, the control program allocates a variable value to at leastsome program variables during execution of the control program, thevariable value being determined by accessing a memory address of theemulated memory area.

The emulator assigns an extended range of items to each program variableof the control program, the variable value allocated to a programvariable being stored in the extended range of items, and the emulatormarks program variables as erroneous or non-erroneous.

The marking is carried out by assigning non-erroneous program variablesto a first category and assigning erroneous program variables to asecond category, the extended range of items of each program variable inthe second category having a data field.

Alternatively, the program variables may be marked on the basis of anerror field stored in the extended range of items, a predeterminednumerical or non-numerical first validity value being allocated to theerror field of a non-erroneous program variable and a predeterminednumerical or non-numerical first error value being allocated to theerror field of an erroneous program variable, the first validity valuediffering from the first error value, and the extended range of items ofeach program variable having a data field.

The marking is carried out when determining a variable value. If theemulated processor accesses a first memory address which is present andhas been written to in the emulated memory area or accesses a secondprogram variable in order to determine a variable value of a firstprogram variable, the second program variable being assigned to thefirst category or having an error field with a first validity value, theprogram variable is marked as non-erroneous, and the variable valuedetermined is stored in the extended range of items.

If the emulated processor accesses a second memory address which is notpresent or has not been written to in the emulated memory area oraccesses a third program variable which is assigned to the secondcategory or has an error field with a first error value when determininga variable value of a first program variable, the first program variableis marked as erroneous, a predetermined numerical or non-numericalsecond error value is allocated to the variable value of the firstprogram variable and the second memory address which is not present orhas not been written to or a copy of all entries in the data field ofthe third program variable is written to the data field of the firstprogram variable.

It is noted that the present case describes so-called off-linesimulation in which the control software is tested in a simulatedenvironment on a computer, for example a PC. Simulation in real time isusually not required in off-line simulations.

The emulator makes it possible to execute a control program directly inmachine language by emulating the control device processor. A programwhich emulates the control computer and thereby makes it possible toexecute the control program on another computer apart from the controlcomputer is referred to here as an emulator.

In order to reproduce on-chip functionalities of the control device, forexample a CAN controller, an AD/DA converter or further internalfunctionalities of the control device, a control device description fileis used. This file contains a list of all functions and variable namesand their associated addresses, such as an a2I file.

It should be noted that the control program may advantageously be inmachine language within the scope of the method according to embodimentsof the invention since it is executed on an emulator emulating a controldevice processor. Accordingly, the variables of the control program arerepresented by memory addresses, and a variable value is a value of avariable which is stored in a memory cell of the emulated memory whichis assigned to the memory address of the variable. The use of the termvariable here to refer to machine language program component is forpurely illustrative purposes. It is not intended to limit the disclosureto the use of variables in the high-level language sense of the word.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention is explained in more detail below with reference to thedrawings. In this case, identical parts are labeled using identicaldesignations. The embodiments illustrated are schematic. In thedrawings:

FIG. 1 shows a schematic view of an emulator and of a simulationenvironment,

FIG. 2 shows a schematic illustration of a first embodiment of programvariables, and

FIG. 3 shows a schematic illustration of a second embodiment of aprogram variable.

DETAILED DESCRIPTION OF THE INVENTION

The present disclosure also provides that (i) an extended range of itemsis allocated to memory addresses at which a variable value is stored asdescribed above, that (ii) memory addresses which are allocated to anextended range of items can be marked as erroneous or non-erroneous asdescribed above, that, (iii) in the attempt to read in a variable valuefrom a second memory address which is not present or has not beenwritten to in the emulated memory area, the second memory address ismarked as erroneous, and that, (iv) in the attempt to access a thirdmemory address which is marked as erroneous in order to store a newvariable value in a first memory address, the first memory address ismarked as erroneous.

With the creation of the simulation environment, the user generatesparameters needed by the emulator to execute the control program. Inthis case, the parameters referred to as environmental values are bothvalues of variables of the control device and values from externalsensors or the like and can be made available to the control program,for example by means of bypass methods.

In addition to the actual value of a variable, the extended range ofitems makes it possible to manage further information, for exampleinformation relating to errors or supplementary functions. The extendedrange of items comprises, for example, a particular area of a memorywhich is assigned to the program variable and in which furtherinformation is stored in addition to a variable value of the programvariable.

The number and type of entries in the extended range of items can be thesame for all program variables, the extended range of items having, inaddition to the variable value, an error field for marking an error anda data field for documenting the error propagation. A numerical ornon-numerical first error value is allocated to the error field in theevent of an erroneous program variable. If the program variable is noterroneous, a numerical or non-numerical first validity value isallocated to the error field.

The error field is used to mark a program variable as erroneous ornon-erroneous. The non-numerical or numerical first error value assignedto the error field if an error is present can therefore be an arbitraryvalue which must be unique, however, and must differ from the numericalor non-numerical first validity value allocated to the error field if anerror is not present. For example, if an error is not present, the value0 can be allocated to the error field as a first validity value, whichvalue is changed to 1 as a first error value if an error occurs.

If the error marking is carried out by assigning the program variablesto different categories, the number and type of entries in the extendedrange of items of a program variable are determined by the category towhich the corresponding program variable is assigned.

A category may be a class within the scope of object-orientedprogramming, for example. A variable type which is assigned attributesand methods is referred to as a class. An extended range of itemsaccording to embodiments of the invention can therefore compriseattributes and methods in the sense of an object-oriented class. Theextended range of items may also be composed of one or more lists whichare managed in a parallel manner to the management and processing of thevariables and of the variables themselves, a list being created for eachcategory, for example, and the information to be stored in the listsbeing predefined by the category.

In the case of error marking by means of assignment to differentcategories, the extended range of items of a program variable which iserroneous and therefore belongs to the second category has a data fieldfor documenting the error propagation in addition to the variable value.A non-erroneous program variable belongs to the first category. Theextended range of items must have only the variable value. A data fieldis not necessary.

It may be possible to detect an erroneous program variable on the basisof the variable value itself, for example if the second error value is anon-numerical value which is unique within the scope of the controlprogram. It is possible to reliably detect an erroneous program variableon the basis of the value of the error field or on the basis of thecategory of the program variable.

The second error value which is allocated to the variable value if anerroneous memory address or an erroneous variable is accessed can be anydesired non-numerical error value, for example “error”, which can beclearly distinguished from valid, typically numerical variable values.It goes without saying that a numerical error value, for example a zero,can also be assigned to the variable value in the case of erroneousaccess on account of the documentation and error marking by means of thecategory assignment or by means of the error field.

An advantage of the method according to embodiments of the invention isthat the occurrence of an error does not result in the run of thecontrol program being aborted. Since the emulator also completelyexecutes the control program in the event of errors occurring, it ispossible to test parts of the control program. If an individualfunctionality of the control program is intended to be tested, only allenvironmental values needed for the functionality to be tested must besimulated in the simulation environment and written to the emulatedmemory area via the interface of the emulator since the absence ofenvironmental values for other functionalities which do not need to betested does not result in the control program being aborted.

A particular advantage is that information relating to an original errorsource is passed on. After the control program has been completely runfor each program variable, the origin of an error can therefore bedirectly read on the basis of the addresses entered in the data field.This provides information relating to errors or incomplete parts of thecreated simulation specifically with regard to the program variableswhich are of interest.

In one embodiment, when determining a variable value of a first programvariable when accessing a program variable which is assigned to thesecond category or when accessing a second program variable which has anerror field with a first error value, an identifier of the secondprogram variable is written to the data field of the first programvariable. This documents the entire path of the error or the errorpropagation. Any identifier which uniquely identifies the programvariable is suitable as the identifier of the program variable, forexample the name of the program variable or the memory address of theprogram variable.

According to another embodiment, if the control program allocates apredefined value to a first program variable which is assigned to thesecond category or has an error field with a first error value, thefirst program variable is marked as non-erroneous, the predefined valueis stored as the variable value in the extended range of items of thefirst program variable, the data field being deleted from the extendedrange of items in the case of marking on the basis of an assignment to afirst category or a second category, and all entries in the data fieldbeing deleted in the case of marking on the basis of an error field.This makes it possible to break the error propagation. On account of avalid value being allocated, the program variable is marked as validagain or is carried on.

In combination with the documentation of the error propagation, thepossibility of not necessarily eliminating an error at the origin, forexample by emulating the necessary memory address, but rather bydirectly allocating a valid value to a subsequent program variable,arises.

In the case of the marking on the basis of a category assignment, aprogram variable which is non-erroneous and is therefore assigned to thefirst category does not have to have a data field. However, it is alsopossible to provide a data field in the extended range of items of aprogram variable assigned to the first category, this data field nothaving any entries. If the program variables assigned to the firstcategory also have a data field, the entire data field is not deletedfrom the extended range of items if a program variable is changed fromthe second category to the first category, but rather only all entriesin the data field are deleted or no entries in the data field aretransmitted.

In another embodiment, the control program has at least two programblocks, the program blocks being alternatively executed according to aconditional branching rule of the control program on the basis of acondition. If the condition depends on a first program variable which isassigned to the second category or has an error field with a first errorvalue, that is to say an erroneous first program variable, all programblocks are executed. Executing all alternative rules of a controlprogram provides the user with information after executing the controlprogram for all possible program variants.

According to one embodiment, each further program variable which isallocated a value during execution of the program blocks is marked aserroneous, a copy of all entries in the data field of the first programvariable respectively being written to the data field of the furtherprogram variable, and the second error value respectively beingallocated to the variable value of the further program variable. As aresult of this, all program variables dependent on the conditionalbranching rule can be reliably and easily identified after executing thecontrol program.

According to an alternative embodiment, after executing the programblocks for each further program variable to which the control programallocates a variable value both during execution of the first programblock and during execution of a further program block, the allocatedvariable values are compared. In the event of a difference between theallocated variable values, the further program variable is marked aserroneous, the second error value is allocated to the variable value ofthe further program variable, and a copy of all entries in the datafield of the first program variable is written to the data field of thefurther program variable. This ensures that only those program variableswhose variable value actually depends on the branching rule are markedas erroneous and provide information relating to the origin of theerror.

If, for example, it is only formally a conditional branch, for exampleif the variable values allocated to the program variables in thedifferent program blocks are identical, an error is also not marked orpassed on. If it is a purely formal conditional branch only with regardto one or more program variables, for example for a single variable A,whereas the variable values of other program variables depend on theconditional branching rule, the one or more program variables, forexample the variables A, is/are marked as non-erroneous, whereas theother program variables are marked as erroneous.

The image in FIG. 1 shows a view of a first embodiment, a controlprogram 10 in machine language for a control device (not illustrated)being executed by an emulator 20 on a computer 30 by virtue of theemulator emulating a processor of the control device and a memory area24 of the control device. The emulator 20 has an interface 22 forinputting and outputting data.

In order to test one or more functions F1, F2, F3 of the control program10, all environmental values 42 which are required by the one or morefunctions F1, F2, F3 are generated within the scope of a simulationenvironment 40 on the computer 30. The environmental values 42 are madeavailable to the emulator 20 by virtue of the environmental values 42being written to the emulated memory area 24 by means of the interface22 for inputting and outputting data. The environmental values 42 canrepresent both variables of the control device, such as functionalitiesprovided by on-chip components, and data transmitted to the controldevice from the outside, for example from external sensors.

During execution of the control program 10, variable values areallocated to program variables. Either a memory address in the emulatedmemory area 24 or at least one other program variable is accessed forthis purpose. If the created simulation environment or the environmentalvalues generated is/are incomplete, memory addresses queried by thecontrol program may be missing in the emulated memory area or may nothave been written to. Both situations result in an erroneous variablevalue of the program variable. Accordingly, access to an erroneousprogram variable results in a sequential error.

In accordance with an embodiment of the invention, an extended range ofitems 50, 60, 70 is allocated to a program variable for the purpose ofdocumenting an error. The image in FIG. 2 shows a schematic view of afirst program variable on the left-hand side. The first program variableillustrated is non-erroneous and is therefore assigned to a firstcategory K1 by the emulator 20. The first program variable has anextended range of items 50, the extended range of items 50 having thevariable value 52.

The right-hand side of FIG. 2 shows a schematic view of a second programvariable which is erroneous and therefore belongs to a second categoryK2. Whereas the variable value 52 of the first program variable has anarbitrary value, the second error value error is always allocated to thevariable value 62 of the second program variable. A memory address isstored in the data field 64 of the second program variable. The memoryaddress corresponds to the memory address which was queried for thepurpose of allocating a value for the second program variable duringexecution of the control program 10 and is either not present in theemulated memory area 24 or has not been written to.

According to the first exemplary embodiment shown in FIG. 2, differentcategories K1, K2 are provided for erroneous and non-erroneous programvariables. If an error occurs as a result of a memory address which isnot present or has not been written to in the emulated memory area beingaccessed, the program variable is assigned to the second category K2. Inaddition, the second error value error is allocated to the variablevalue 62 and the memory address is written to the data field 64. If anerror occurs due to accessing another erroneous program variable, thesecond program variable is likewise assigned to the second category K2,the second error value error is allocated to the variable value 62 andall memory addresses noted in the data field of the other erroneousprogram variable are additionally copied to the data field 64 of thesecond program variable.

A second exemplary embodiment is illustrated in FIG. 3. In this case,all program variables have an identical extended range of items 70 whichadditionally comprises an error field 76 in addition to a variable value72 and a data field 74. A first validity value, for example 0, isassigned to the error field 76 of a non-erroneous program variable. Ifan error occurs, the category is not changed according to the secondexemplary embodiment, but rather a first error value, for example 1, isallocated to the error field.

As a result of the errors being passed on, that is to say memoryaddresses being written or copied into the data fields 64, 74, allnecessary information relating to errors which have occurred is providedafter the run. It is therefore possible to also test only a firstfunction F1 of the control program 10 by generating only theenvironmental values relevant to the first function F1 in the simulationenvironment and making them available to the emulator by means of theinterface 22. As a result, the output values from the further functionsF2, F3 which are not of interest will be erroneous.

On the basis of the variable value, the category and/or the error fieldof the program variables, which are provided as output values from thefirst function F1, it is determined whether an error has occurred duringexecution of the first function F1. The data field 64, 74 of the programvariables provides information relating to the location at which theerror has occurred and how it has propagated.

The entirety of this disclosure (including the Cover Page, Title,Headings, Field, Background, Summary, Brief Description of the Drawings,Detailed Description, Claims, Abstract, Figures, and otherwise) shows byway of illustration various embodiments in which the claimed inventionsmay be practiced. The advantages and features of the disclosure are of arepresentative sample of embodiments only, and are not exhaustive and/orexclusive. They are presented only to assist in understanding and teachthe claimed principles. It should be understood that they are notrepresentative of all claimed inventions. As such, certain aspects ofthe disclosure have not been discussed herein. That alternateembodiments may not have been presented for a specific portion of theinvention or that further undescribed alternate embodiments may beavailable for a portion is not to be considered a disclaimer of thosealternate embodiments. It will be appreciated that many of thoseundescribed embodiments incorporate the same principles of the inventionand others are equivalent. Thus, it is to be understood that otherembodiments may be utilized and functional, logical, organizational,structural and/or topological modifications may be made withoutdeparting from the scope and/or spirit of the disclosure. As such, allexamples and/or embodiments are deemed to be non-limiting throughoutthis disclosure. Also, no inference should be drawn regarding thoseembodiments discussed herein relative to those not discussed hereinother than it is as such for purposes of reducing space and repetition.For instance, it is to be understood that the logical and/or topologicalstructure of any combination of any program modules (a modulecollection), other components and/or any present feature sets asdescribed in the figures and/or throughout are not limited to a fixedoperating order and/or arrangement, but rather, any disclosed order isexemplary and all equivalents, regardless of order, are contemplated bythe disclosure. Furthermore, it is to be understood that such featuresare not limited to serial execution, but rather, any number of threads,processes, services, servers, and/or the like that may executeasynchronously, concurrently, in parallel, simultaneously,synchronously, and/or the like are contemplated by the disclosure. Assuch, some of these features may be mutually contradictory, in that theycannot be simultaneously present in a single embodiment. Similarly, somefeatures are applicable to one aspect of the invention, and inapplicableto others. In addition, the disclosure includes other inventions notpresently claimed. Applicant reserves all rights in those presentlyunclaimed inventions including the right to claim such inventions, fileadditional applications, continuations, continuations in part,divisions, and/or the like thereof. As such, it should be understoodthat advantages, embodiments, examples, functional, features, logical,organizational, structural, topological, and/or other aspects of thedisclosure are not to be considered limitations on the disclosure asdefined by the claims or limitations on equivalents to the claims.

What is claimed is:
 1. A method for monitoring errors when testing acontrol program of a control device in a simulation environment on acomputer, the method comprising: generating the simulation environmenton the computer, executing the control program with an emulator executedon the computer, wherein the emulator is emulating at least one part ofthe control device including an emulated processor and an emulatedmemory area, and the emulator having an interface for inputting andoutputting data, writing environmental values from the simulationenvironment to the emulated memory area via the interface, the controlprogram having one or more program variables, allocating one or morevariable values to the one or more program variables by the controlprogram during execution of the control program, wherein the allocatedvariable value is determined by accessing a memory address of theemulated memory area, assigning an extended range of items to each ofthe one or more program variables of the control program via theemulator, wherein each of the allocated variable values is stored in arespective extended range of items, marking the one or more programvariables as erroneous or non-erroneous via the emulator, wherein themarking is carried out on the basis of an assignment of non-erroneousprogram variables to a first category and of an assignment of erroneousprogram variables to a second category, each extended range of items ofa program variable in the second category having a data field, or themarking is carried out on the basis of an error field stored in theextended range of items of each program variable, a first predeterminednumerical or non-numerical validity value being allocated to therespective error field of a non-erroneous program variable and a firstpredetermined numerical or non-numerical error value being allocated tothe respective error field of an erroneous program variable, and eachextended range of items of each program variable having a data field,wherein the marking is carried out when determining a variable value,wherein, when determining a variable value of a first program variable,the first program variable is marked as non-erroneous both when theemulated processor accesses a first memory address which is present andhas been written to in the emulated memory area and when the emulatedprocessor accesses a second program variable, the second programvariable being assigned to the first category or having an error fieldwith a first validity value, and the determined variable value of thefirst program variable is stored in the extended range of items of thefirst program variable, wherein, when determining a variable value ofthe first program variable, the first program variable is marked aserroneous both when the emulated processor accesses a second memoryaddress which is not present or has not been written to in the emulatedmemory area and when the emulated processor accesses a third programvariable, the third program variable being assigned to the secondcategory or having an error field with a first error value, apredetermined numerical or non-numerical second error value is allocatedto the variable value of the first program variable and the secondmemory address which is not present or has not been written to or a copyof all entries in the data field of the third program variable iswritten to the data field of the first program variable.
 2. The methodas claimed in claim 1, wherein, when determining a variable value of thefirst program variable by accessing the second program variable which isassigned to the second category or has an error field with a first errorvalue, an identifier of the second program variable is written to thedata field of the first program variable.
 3. The method as claimed inclaim 2, wherein, if the control program allocates a predefined value tothe first program variable and if the first program variable is assignedto the second category or has an error field with a first error value,marking the first program variable as non-erroneous, storing thepredefined value as the variable value in the extended range of items ofthe first program variable, deleting the data field from the extendedrange of items of the first program variable in case the marking takesplace on the basis of an assignment to a first category or a secondcategory, and deleting all entries in the data field of the firstprogram variable in case the marking takes place on the basis of anerror field.
 4. The method as claimed in claim 2, wherein, if thecontrol program has at least two program blocks, the program blocksbeing alternatively executed according to a conditional branching ruleof the control program on the basis of a condition and the conditiondepending on the first program variable which is assigned to the secondcategory or has an error field with a first error value, all programblocks are executed.
 5. The method as claimed in claim 4, wherein eachfurther program variable which is allocated a value during execution ofthe program blocks is marked as erroneous, a copy of all entries in thedata field of the first program variable respectively being written tothe respective data field of each of said further program variables, andsaid second error value, which is allocated to the variable value of thefirst program variable, respectively being allocated to the respectivevariable value of each of said further program variables, or each ofsaid further program variables being assigned to the second category. 6.The method as claimed in claim 4, wherein, after executing the programblocks for each further program variable to which the control programallocates a variable value both during execution of the first programblock and during execution of a further program block, the allocatedvariable values are compared, in which case, in the event of adifference between the allocated variable values, marking each of saidfurther program variables as erroneous, allocating the second errorvalue to the variable value of each of said further program variables,and writing a copy of all entries in the data field of the first programvariable to the data field of each of said further program variables. 7.The method as claimed in claim 1, wherein, if the control programallocates a predefined value to the first program variable and if thefirst program variable is assigned to the second category or has anerror field with a first error value, marking the first program variableas non-erroneous, storing the predefined value as the variable value inthe extended range of items of the first program variable, deleting thedata field from the extended range of items of the first programvariable in case the marking takes place on the basis of an assignmentto a first category or a second category, and deleting all entries inthe data field of the first program variable in case the marking takesplace on the basis of an error field.
 8. The method as claimed in claim7, wherein, if the control program has at least two program blocks, theprogram blocks being alternatively executed according to a conditionalbranching rule of the control program on the basis of a condition, thecondition depending on the first program variable, and if the firstprogram variable, is assigned to the second category or has an errorfield with a first error value, all program blocks are executed.
 9. Themethod as claimed in claim 8, wherein each further program variablewhich is allocated a value during execution of the program blocks ismarked as erroneous, a copy of all entries in the data field of thefirst program variable respectively being written to the respective datafield of each of said further program variables, and said second errorvalue, which is allocated to the variable value of the first programvariable, respectively being allocated to the respective variable valueof each of said further program variables, or each of said furtherprogram variables being assigned to the second category.
 10. The methodas claimed in claim 8, wherein, after executing the program blocks foreach further program variable to which the control program allocates avariable value both during execution of the first program block andduring execution of a further program block, the allocated variablevalues are compared, in which case, in the event of a difference betweenthe allocated variable values, marking each of said further programvariables as erroneous, allocating the second error value to thevariable value of each of said further program variables, and writing acopy of all entries in the data field of the first program variable tothe data field of each of said further program variables.
 11. The methodas claimed in claim 1, wherein, if the control program has at least twoprogram blocks, the program blocks being alternatively executedaccording to a conditional branching rule of the control program on thebasis of a condition and the condition depending on the first programvariable which is assigned to the second category or has an error fieldwith a first error value, all program blocks are executed.
 12. Themethod as claimed in claim 11, wherein each further program variablewhich is allocated a value during execution of the program blocks ismarked as erroneous, a copy of all entries in the data field of thefirst program variable respectively being written to the data field ofthe further program variable, and the second error value respectivelybeing allocated to the variable value of the further program variable.13. The method as claimed in claim 11, wherein, after executing theprogram blocks for each further program variable to which the controlprogram allocates a variable value both during execution of the firstprogram block and during execution of a further program block, theallocated variable values are compared, in which case, in the event of adifference between the allocated variable values, marking the givenfurther program variable as erroneous, allocating the second error valueto the variable value of the given further program variable, and writinga copy of all entries in the data field of the first program variable tothe data field of the given further program variable.
 14. A method formonitoring errors when testing a control program of a control device ina simulation environment on a computer, the method comprising:generating the simulation environment on the computer, executing thecontrol program with an emulator executed on the computer, wherein theemulator is emulating at least one part of the control device includingan emulated processor and an emulated memory area, and the emulatorhaving an interface for inputting and outputting data, writingenvironmental values from the simulation environment to the emulatedmemory area via the interface, the control program having one or moreprogram variables, allocating one or more variable values to the one ormore program variables by the control program during execution of thecontrol program, wherein the allocated variable value is determined byaccessing a memory address of the emulated memory area, assigning anextended range of items to each of the one or more program variables ofthe control program via the emulator, wherein each of the allocatedvariable values is stored in a respective extended range of items,marking the one or more program variables as erroneous or non-erroneousvia the emulator, wherein the marking is carried out on the basis ofassigning program variables to categories, wherein the marking iscarried out when determining a variable value, wherein, when determininga variable value of a first program variable, the first program variableis marked as non-erroneous both when the emulated processor accesses afirst memory address which is present and has been written to in theemulated memory area and when the emulated processor accesses a secondprogram variable, the second program variable being assigned to a firstcategory or having an error field with a first validity value, and thedetermined variable value of the first program variable is stored in theextended range of items of the first program variable, wherein, whendetermining a variable value of the first program variable, the firstprogram variable is marked as erroneous both when the emulated processoraccesses a second memory address which is not present or has not beenwritten to in the emulated memory area and when the emulated processoraccesses a third program variable, the third program variable beingassigned to a second category or having an error field with a firsterror value, a predetermined numerical or non-numerical second errorvalue is allocated to the variable value of the first program variableand the second memory address which is not present or has not beenwritten to or a copy of all entries in a data field of the third programvariable is written to a data field of the first program variable. 15.The method as claimed in claim 14, wherein the marking that is carriedout on the basis of assigning program variables to categories comprisesassigning of non-erroneous program variables to a first category and ofassigning erroneous program variables to a second category, wherein eachof the extended range of items of each program variable in the secondcategory having a data field.
 16. A method for monitoring errors whentesting a control program of a control device in a simulationenvironment on a computer, the method comprising: generating thesimulation environment on the computer, executing the control programwith an emulator executed on the computer, wherein the emulator isemulating at least one part of the control device including an emulatedprocessor and an emulated memory area, and the emulator having aninterface for inputting and outputting data, writing environmentalvalues from the simulation environment to the emulated memory area viathe interface, the control program having one or more program variables,allocating one or more variable values to the one or more programvariables by the control program during execution of the controlprogram, wherein the allocated variable value is determined by accessinga memory address of the emulated memory area, assigning an extendedrange of items to each of the one or more program variables of thecontrol program via the emulator, wherein each of the allocated variablevalues is stored in a respective extended range of items, marking theone or more program variables as erroneous or non-erroneous via theemulator, wherein the marking is carried out on the basis of an errorfield stored in each of the extended range of items, wherein the markingis carried out when determining a variable value, wherein, whendetermining a variable value of a first program variable, the firstprogram variable is marked as non-erroneous both when the emulatedprocessor accesses a first memory address which is present and has beenwritten to in the emulated memory area and when the emulated processoraccesses a second program variable, the second program variable beingassigned to a first category or having an error field with a firstvalidity value, and the determined variable value of the first programvariable is stored in the extended range of items of the first programvariable, wherein, when determining a variable value of the firstprogram variable, the first program variable is marked as erroneous bothwhen the emulated processor accesses a second memory address which isnot present or has not been written to in the emulated memory area andwhen the emulated processor accesses a third program variable, the thirdprogram variable being assigned to a second category or having an errorfield with a first error value, a predetermined numerical ornon-numerical second error value is allocated to the variable value ofthe first program variable and the second memory address which is notpresent or has not been written to or a copy of all entries in a datafield of the third program variable is written to a data field of thefirst program variable.
 17. The method as claimed in claim 16, whereinthe marking that is carried out on the basis of an error field stored inthe extended range of items of each program variable comprises a firstpredetermined numerical or non-numerical validity value being allocatedto the respective error field of a non-erroneous program variable, afirst predetermined numerical or non-numerical error value beingallocated to the respective error field of an erroneous programvariable, wherein each extended range of items of each program variablehas a data field.